CIS 417 Assignments Week 2 to 10 Computer Forensics Strayer

CIS 417 Assignments Week 2 to 10 Computer Forensics

CIS 417 Week 2 Assignment 1 – Computer Forensic Overview

Suppose you were recently hired for a new position as the computer forensics specialist at a mediumsized communications company. You have been asked to prepare a presentation to the Board of Directors on your main duties for the company and how your position could help achieve business goals based on security and confidentiality.

You are also aware that the company has just had some issues with employee complaints of ongoing sexual harassment over email and instant messaging systems but has been unable to obtain adequate evidence of any kind.

Write a two to three (2-3) page paper in which you:
1. Explain the basic primary tasks, high-level investigation processes, and challenges of a computer
forensics specialist.

2. Provide an overview of how computing devices are used in crimes of today and how these crimes
can affect a companys data and information.

3. Discuss how computer forensics investigations pertain to the law and trying of cases.

CIS 417 Week 3 Case Study 1 – BTK

In 2005, serial killer Dennis Rader, also known as BTK, was arrested and convicted of murdering 10people in Kansas between the years of 1974 and 1991. Further research this incident using quality and reputable resources.

Write a two to three (2-3) page paper in which you:
1. Explicate how digital forensics was used to identify Rader as a suspect and lead to more concrete
physical evidence.

2. Describe in detail the digital evidence that was uncovered from the floppy disk obtained from
Rader. Discuss why you believe it took so many years to find concrete evidence in order to build
a case against Rader.

3. Explain how the acquisition of digital evidence aided the investigation and whether or not you
believe Rader wouldve been a person of interest if the floppy disk evidence wasnt sent.

CIS 417 Week 4 Assignment 2 – Forensic Lab Design

Imagine the university that employs you as an information security professional has recently identified the need to design and build a digital forensic laboratory. You have been tasked with designing the lab for the organization.

Write a four to five (4-5) page paper in which you:
1. Explicate the steps you would take to plan a budget for the lab, keeping in mind the general
business objective to avoid unneeded costs.

2. Recommend the physical requirements and controls that you would consider implementing in
order to keep the lab safe and secure.

3. Identify at least three (3) hardware and software tools that you would include in the design of the
lab and explain your reasons behind your choices.

4. Identify the high-level criteria that would be considered when selecting the forensic workstations
to be utilized.

CIS 417 Week 5 Case Study 2 – External Intrusion of the PlayStation Network

On April 20, 2011, the Sony PlayStation Network was taken offline after an external intrusion was discovered. Further research this incident using quality and reputable resources.

Write a two to three (2-3) page paper in which you:
1. Briefly summarize the details of the attack on the PlayStation Network, including the dates of
when the attack started and was eventually uncovered.

2. Indicate what explanation Sony officials gave for the length of time that had passed from the start
of the attack to when the general public was made aware of the details.

3. Analyze and explain what you believe the correct forensic investigative action would have been
once the attack was uncovered.

CIS 417 Week 6 Assignment 3 – Securing the Scene

Imagine you are a digital forensic investigator for a healthcare organization. You learn from your internal information security department that an employee has been using password-cracking software to access confidential customer insurance information.

The account information extracted is unknown at this time, though it appears as though multiple computers were being used for the crime and it isnt clear whether an attack is currently in progress. The employee has been detained but his computers remain online.

Write a two to three (2-3) page paper in which you:
1. Develop a detailed plan to approach and secure the incident scene based on the information you
have from the scenario.

2. Discuss the initial steps you would take for the investigation, depending on whether or not the
attack is still in progress. Include how your actions would differ based on the current status of the
incident.

3. Explicate the importance of creating an order of volatility by identifying the potential evidence that
is the most volatile. Explain, in detail, how you would extract this evidence.

CIS 417 Week 7 Case Study 3 – Casey Anthony Trial

On July 5, 2011, Casey Anthony was found not guilty of first-degree murder in the 2008 death of her daughter, Caylee. Further research this incident using quality and reputable resources.
Write a two to three (2-3) page paper in which you:

1. Provide a brief summary of the background, charges, and trial of this high-profile court case.

2. Explain, from a forensics perspective, the digital evidence found on the Anthony family computer
that helped the prosecutors build a case against Anthony.

3. Describe what the prosecution was unable to prove based on the digital evidence found. Indicate
whether or not you think this is a common problem with digital evidence and provide a rationale
for your response.

4. Explain the software issue that was found to have caused inaccurate evidence to be admitted into
the trial.

CIS 417 Week 8 Assignment 4 – Data-Hiding Techniques

Suppose you are the Chief Security Officer for a financial institution. Someone on your information security staff has informed you that recent Web content filters have shown an end user who has been visiting sites dedicated to alternate data stream (ADS) and steganography hiding techniques.

She is interested in what the end user may be doing and comes to you for some explanation on these techniques.

Write a two to three (2-3) page paper in which you:

1. Explain how a user could utilize ADS to hide data and explain other destructive uses which exist for ADS.

2. Determine how rootkits can be used as an alternative for data hiding and explicate why they can be used for this purpose.

3. Describe the processes and tools used by an investigator in determining whether signs of steganography are present in a given situation.

CIS 417 Week 10 Term Paper – Investigating Data Theft

Suppose a large aerospace engineering firm has immediately hired you as a consultant to investigate a
potential violation of corporate policy and data theft. You have been informed that an employee may have
been using corporate email to send confidential corporate information to one or more personal email
accounts, which may or may not belong to him.

You have been told that this action has been happening
each business day for the last 13 days and the employee is unaware of any suspicion.
Write an eight to ten (8-10) page paper in which you:

1. Explain, in detail, the initial actions you would take based on the provided information including
formal plans to preserve the crime scene(s) and eventual transportation of evidence to a lab.

2. Analyze the physical and logical places where you would look for potential evidence on the
suspects computer(s) and / or network servers.

3. Describe, in detail, how you proceed with the email investigation, including the review of email
headers and tracing.

4. Describe the processes that would be utilized in order to recover data that may have been
deleted from the suspects computer(s).